GO-2024-2490
Path traversal in github.com/anchore/stereoscope
At a glance
- Published
- Updated
- CVE
- CVE-2024-24579
- Aliases
- GHSA-hpxr-w9w7-g4gv
Description
It is possible to craft an OCI tar archive that, when stereoscope attempts to unarchive the contents, will result in writing to paths outside of the unarchive temporary directory.
Affected packages
| Package | Versions |
|---|---|
| Go · github.com/anchore/stereoscope | introduced 0, fixed 0.0.1 |
References
- https://github.com/anchore/stereoscope/security/advisories/GHSA-hpxr-w9w7-g4gv ADVISORY
- https://github.com/anchore/stereoscope/commit/09dacab4d9ee65ee8bc7af8ebf4aa7b5aaa36204 FIX
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |